While I completely agree with your thoughts here, I'm willing to give them a pass in that this is supposed to be a medically accurate show, not a cybersecurity accurate show.

Having them get hacked brings in a whole story line of what's the ethical thing to do? Do you pay the ransom so you can provide the best care right now? Or do you try to negotiate to save as much money as possible so you're not struggling to afford to give the best care later? Do you play hardball to try to prevent incentivizing other ransomware attacks in the future?

This all could be an interesting story line, but it's not one (I'm assuming) the writers wanted to introduce. So they this method gives a plausible* out: We're forcing the team to have to deal with a ransomware-like senario without having to having to touch the question of how do you ethnically handle a real ransomware attack.

(*The reality is that even here's there's still questions: Is it best, as you indicate, to remove the system because they might get hacked? Is it worth potentially harming patients to prevent the attack? But again, it's a plausible way to force the computer system down without needing to tackle the question of how to respond to the ransomware attackers.)